# Activity log

> Every AI request, management action and security event is logged on your server. What each entry holds, how long it is kept and how to review a session.

The activity log is the record of everything that reaches PowerWP AI: which app called which tool, when, from which IP address, and whether it worked. It lives in your own database. Open it under **PowerWP AI › Activity**.

## What is logged

| Channel | What goes in |
|---|---|
| AI requests | Every request from an AI app and each tool call. |
| Security | Failed authentications, lockouts, blocked IP addresses, and revoked or expired keys that were used. |
| System | Plugin activated or deactivated, backups and restores, rescue mode and maintenance mode switched on or off, the daily clean-up. |
| wp-admin | What you do on the PowerWP AI screens: switching AI access, saving settings, rolling back. |
| Management | Actions made through a management key. |
| Transfers | Use of the signed links for large file downloads and uploads. |

## What an entry holds

| Field | Meaning |
|---|---|
| Time, channel, level | When it happened and where it belongs. |
| Event and tool | For example `tools/call` and the tool name, such as `content_update`. |
| Status | **OK**, **Error**, **Tool error** or **Denied**. A denied call was refused, for example for a missing permission. |
| Client | The name and version the AI app reports for itself. |
| Credential | The connection that was used. |
| IP address and user agent | Where the request came from. The address follows **Settings › Connection security › Client IP source**. |
| Session | An ID that groups the calls of one app on one connection and IP address. |
| Duration and traffic | How long the call took and how many bytes went in and out. |
| Changes | How many changes were recorded by the call, with a link to them. |
| Request | The arguments the app sent. |
| Response | A short preview of the result. |

Passwords and keys are hidden before anything is stored. Arguments with names such as password, secret, token, API key, authorization, cookie, nonce or license key are replaced by `[redacted]`. PowerWP AI's own keys and the keys in signed download links are removed from text. Long texts are shortened, so file contents do not fill the log.

The response preview is a short, redacted extract. Switch it off under **Settings › Activity log › Store response previews**.

## How long it is kept

Under **Settings › Activity log**, **Log retention** sets the number of days. The default is 60 days and you can choose 1 to 3,650. Older entries are deleted once a day. The log also keeps at most the newest 250,000 entries.

Entries leave the log only through this clean-up. There is no tool that deletes or changes log entries, so an AI app cannot hide what it did.

## Find what you need

The **Activity** screen lists entries newest first. You can search messages, tools, events and arguments, and filter by channel, status, tool and start date. The numbers on the dashboard for the last 24 hours (AI requests, tool calls, errors, denied, security events) open the log with the matching filter.

Select an entry to see all its fields. **Same session** and **Same IP** show related entries. **CSV** and **JSON** export the entries you have loaded.

## Review a session

:::steps
1. Open **PowerWP AI › Activity** and set the date to the day of the session.
2. Open any entry of the app you want to check and choose **Same session**. An app that stays connected for days keeps the same session ID, so narrow the date again if the list is long.
3. Look at the status of each entry. Open the **Errors** and **Denied** ones first.
4. Where an entry shows journaled changes, follow the link to **PowerWP AI › Changes**. Roll a change back there if it is wrong.
:::

To see a whole sitting of one app, **PowerWP AI › Changes › Work sessions** is often quicker. See [Checkpoints and work sessions](/docs/safety/checkpoints/).

## Ask your AI app

[`audit_log`](/docs/reference/tools/#audit_log) lets an AI app read the log, including other sessions. It can filter by channel, status, tool, search text and start time, show only its own calls with `mine_only`, and include arguments and result previews with `include_requests`. It returns up to 300 entries at a time.

```
Show me everything that was denied or failed in the last 24 hours, and which connection was used. Don't change anything.
```

```
List the tool calls from yesterday's session that changed something, with their change IDs.
```

PowerWP AI can also e-mail you when a new connection is created, an IP address is locked out, a token is used from a new IP address, a change is rolled back or a restore starts. Choose the events under **Settings › Alerts**.

:::cards
- [Change log and undo](/docs/safety/undo/) — The record of what changed, and how to roll it back.
- [Data and privacy](/docs/security/data/) — What stays on your server.
- [Keys and access control](/docs/security/access-control/) — Lockouts, expiry and IP allow-lists.
:::

Source: https://powerwp.ai/docs/safety/activity-log/